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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial proceedings 
which will directly affect or be directly affected by or have a bearing on the Board's decision in 
the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection contained in 
the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 



(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is correct. 
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(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 



(8) Evidence Relied Upon 

6, 1 82 1 46 Graham-Cumming, Jr. 1 -200 1 

5,802,305 McKaughan et al. 9-1998 

6,493,824 Novoa et al. 12-2002 

(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 2-3 are rejected under 35 U.S.C. 103(a) as being unpatentable over Graham- 
Cumming, Jr., (previously cited, "Graham") in view of McKaughan et al., U.S. Patent 5,802,305 
("McKaughan", previously cited). 

As to claim 2, Graham teaches a method comprising: 
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receiving a packet (raw packet data) at a port filter (packet analysis module 100, figure 
3), wherein the packet comprises a port identifier (Destination Port, figures 1 and 2); 
determining whether there is host application associated (application identifier on line 
209, figure 3) with the port identifier (also 605, 607 and 611, figure 6 and corresponding 
text); and 

when there is not a host application associated with the port identifier, discarding the 
packet (discard packet 623 figure 6, col. 7 lines 51-54 and col. 1 1 lines 14-19). 

Graham does not specifically disclose when there is a host appUcation assigned to the 
port number, sending a wake-up message to a power-managed host computer that is one of a 
laptop computer and a portable computer operable in either a power-managed state or an 
operational state. 

McKaughan teaches sending a wake-up message to a power-managed host computer that 
is one of a laptop coniputer and a portable computer operable in either a power-managed state or 
an operational state (col. 3 lines 15-23 and col. 10 lines 50- 55). Specifically, McKaughan 
teaches a computer system similar to that of Graham. The system of McKaughan, like Graham, 
filters packets based on the port numbers. In McKaughan, if a packet is accepted, it will send a 
wake-up message to wake up the computer system (figure 4). McKaughan also like Graham 
teaches that his system is usable in many types of computer environments (col. 10 lines 50-55). 
McKaughan fiirther teaches that power management in general refers to the ability of powering 
down a computer or certain devices when they are not being used. McKaughan fiirther teaches 
that power is restored to the computer or devices when they are required for use (col. 3 lines 24- 



Application/Control Number: 09/746,205 Page 5 

Art Unit: 2116 

30). McKaughan implements power management by supplying power only to devices required 
during packet filtering and acceptance or rejection thereof (only power to the network card is 
maintained, col. 6 line 60 through col. 7 line 9). Thus, McKaughan teaches that power should be 
conserved in portable and AC powered computer systems and teaches an improved apparatus for 
doing so in a network environment. 

It would have been obvious to one of ordinary skill in the art, having the teachings of 
Graham and McKaughan before him at the time the invention was made, to modify the system 
and method disclosed by Graham to include power management as taught by McKaughan to 
obtain sending a wake-up to a power-managed host computer when there is a host application 
assigned to the port number. The teachings of McKaughan would suggest to one of ordinary 
skill that power supplied to the entire computer is not necessary to determine if a host application 
is associated to a port number of a packet. One of ordinary skill would modify Graham, based 
on McKaughan teachings, by supplying power to the devices needed by the packet analysis 
module until a determination of the packet is made. Specifically, power would only need to be 
supplied to the elements in figure 3. If the packet were to be passed on to the application a 
wake-up message would be sent to power up the computer so that it may be processed. One of 
ordinary skill would have made the modification to achieve power conservation in a computer 
system in a network environment in view of the teachings of McKaughan. 

As to claim 5, Graham together with McKaughan taught the method according to claim 2 
as described above. Graham further teaches receiving information from the host computer and 
using the information to carry out a determining whether determining whether there is a host 
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application associated with the port number (determines which application is appropriate to 
handle the packet and the packet is sent to an apphcation for processing, col. 6 lines 18-21 and 
col. 7 lines 43-45), wherein the information comprises executable instructions (passing the 
packet to the identified application, col 12 Unes 49-52). It is interpreted that passing the packet 
to the identified application requires using software. Software contains executable instructions. 
Further, one of ordinary skill in the art would appreciate that when one the packet is passed to 
the identified application the application would process the packet. Processing the packet with 
the application also utilizes executable instructions. 

As to claim 9, Graham together with McKaughan taught the method according to claim 2 
as described above. Graham fiirther teaches detecting a port in use by the host application 
(application to port mapping table, col. 5 line 66 through col. 6 line 1). Graham also teaches 
selecting information based on the port in use by the host apphcation (apphcation identifier, col. 
6 lines 4-10). Finally, Graham teaches sending information to the port fiher, wherein the port 
filter uses the information carry out a determining whether there is a host application associated 
with the port (determines which application is appropriate to handle the packet and the packet is 
sent to an application for processing, col. 6 lines 18-21 and col. 7 lines 43-45). 

As to claims 12-16 and 19-20, Graham together with McKaughan taught the claimed 
method. Therefore together they also taught the claimed signal-bearing media comprising 
instructions. Specifically, it appears that claims 12-16 and 19-20 recite the same limitations as 
those in claim 2-3, 5 and 9. Therefore claims 12-16 and 19-20 are rejected for the same reasons. 
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As to claim 17, Graham together with McKaughan taught the signal-bearing media 
according to claim 15 as described above. Graham further teaches wherein the information 
comprises data, wherein the data is to describe the host application (passing the packet to the 
application requires data that describes the host appUcation, 619 and 710 in figures 6 and 7). 

As to claim 18, Graham together with McKaughan taught the signal-bearing media 
according to claim 15 as described above. Graham further teaches wherein the information 
comprises data, and wherein the data is to describe the port number (col. 10 lines 15-28). The 
port number is necessary because it is associated with application in Graham. 

As to claim 21, Graham together with McKaughan taught the signal-bearing media 
according to claim 19 as described above. Graham further teaches wherein the information 
comprises data, wherein the data is to describe the host application (passing the packet to the 
appUcation requires data that describes the host application, 619 and 710 in figures 6 and 7). 

As to claim 22, Graham together with McKaughan taught the signal-bearing media 
according to claim 19 as described above. Graham further teaches wherein the information 
comprises data, and wherein the data is to describe the port number (col. 10 lines 15-28). The 
port number is necessary because it is associated with appUcation in Graham. 

As to claims 23-29, Graham together with McKaughan taught the claimed method and 
claimed signal-bearing media. Therefore together they also taught the claimed apparatus. 
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Specifically, it appears that claims 23-29 recite the same limitations as those in claim 2-22. 
Therefore claims 23-29 are therefore rejected for the same reasons. 

Regarding claim 30, Graham together with McKaughan taught the method according to 
claim 2, as described above. Graham further teaches sending the packet to the host when there is 
a host appHcation associated with the port number (Destination Port, figures 1 and 2). Graham 
together with McKaughan teaches that the host would be power managed. 

Claims 31-38 are rejected under 35 U.S.C. 103(a) as being unpatentable over Novoa et 
al., U.S. 6,493,824 in view of Graham-Gumming, Jr., (previously cited, "Graham"). 

Regarding claims 31 and 33, Novoa teaches an apparatus, comprising: 
a first stage filter to: 

receive a packet (detecting a packet col. 4, lines 54-56, col. 9, lines 18-24); 

interrogate the packet as to whether the packet includes data that matches 
selected data of a host computer (verifies that the packet destination address 
matches the destination address of the network interface, col. 4, Hnes 54-56); 

forward the when the packet includes data that matches selected data of 
the host computer (to determine a security field, col. 9, hnes 34-35); and 

reject the packet when the packet does not include data that matches 
selected data of the host computer (discarding packet if address does not match, 
col. 8, Unes 25-35). 



1 
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Novoa teaches using a second stage filter for security purposes (step 414, col. 9, lines 43- 
53). However, Novoa does not explicitly disclose v^herein the second stage filter is to: 
receive the packet comprising a port number; 

determine v^hether there is a host application associated with port number; 

reject the packet when there is not a host application associated with the port number; 

wherein the apparatus fiarther is to present the packet to the host computer when there is a 
host application associated with the port number and when the packet includes data that matches 
the selected data of the host computer. 

Graham teaches using a filter to: 

receive a packet comprising a port number (Destination Port, figures 1 and 2); 

determine whether there is a host application associated with the port number (application 
identifier on line 209, figure 3 and also 605, 607 and 61 1, figure 6 and match between port 
numbers of the packet and an application object, col. 10, lines 15-28); 

and reject the packet when there is not a host application associated with the port number 
(discarding the packet when applications are unknown, 623, figure 6); 

wherein the apparatus fiirther is to present the packet to the host computer when there is a 
host application associated with the port number and when the packet includes data that matches 
the selected data of the host computer (pass the packet to the application 619; wherein the 
application resides on the host computer, figure 6). The invention of Graham is in the same field 
of endeavor as that of Novoa in that both inventions are directed toward filtering packet fi-om the 
network. Graham fiarther teaches that his invention is related to dynamically mapping application 
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and port relationships (col. 2, lines 20-24) and that dynamic ports are frequently used to provide 
security (col. 1, lines 60-63). Graham further teaches that his invention further provides the 
advantage of improve accuracy in the detection and accounting of traffic data, and the ability to 
accurately report and manage such traffic (col. 12, line 66 through col. 13, line 5). Graham 
further provides the desirable advantage of a dynamically mapping application and port 
relationships to correctly identify applications, protocols and other network data from packet 
data (col. 2, lines 20-24). 

It would have been obvious to one of ordinary skill in the art, having the teachings of 
Novoa and Graham before them at the time the invention was made, to modify the second filter 
of Novoa to include the filter as taught by Graham. 

One of ordinary skill in the art would have been motivated to make the modification in 
order improve the accuracy in the detection and accounting of traffic and accurately report and 
manage such traffic. Further, Graham suggests that such a filter would be useful for providing 
security in such a network system. The invention of Novoa is directed to discriminate in a power 
down state between authorized wake-up packets and unauthorized wake-up packets (col. 4, lines 
30-44). Graham teaches that only packets with a port number having an associated application 
would be allowed to function on the computer because it has been identified (col. 2, lines 27-34, 
and col. 11, lines 14-19). That is, in Graham unidentified packets will be discarded. Those of 
ordinary skill will understand and appreciate that discarding unidentified packets would also 
increase security. 
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Regarding claim 34, Novoa together with Graham taught the apparatus according to 
claim 33, as described above. Graham further teaches wherein there is a host apphcation 
associated with the port number and when the packet includes data that matches the selected data 
of the host computer (application identifier on line 209, figure 3 and also 605, 607 and 61 1, 
figure 6 and match between port numbers of the packet and an application object, coL 10, lines 
15-28). Novoa further teaches the apparatus is further to send a wake-up message to the host 
computer, wherein the host computer is operable in either a power-managed state or an 
operational state (step 416, awaken computer only when security valid, col. 9, lines 44-53). In 
the case of Novoa together with Graham, security would not be vahd unless a match of a packet 
with a port number with an application associated with the port number is made. 

Regarding claims 32 and 35, Novoa together with Graham taught the apparatus according 
to claim 33, as described above. Novoa further teaches wherein the first stage filter includes a 
pattern filter (wake-up pattem, col. 4, lines 48-57). Graham further teaches wherein the second 
stage filter includes a port filter (determining if a port number is matched between a packet and 
an application, col. 10, lines 18-24). 

Regarding claims 36-38, Novoa together with Graham taught the claimed apparatus, as 
described above, therefore they also teach the claimed method. 

(10) Response to Argument 

First, it is noted that the Appellant does not argue that the rejections lack any limitation or 
element with respect to the claimed invention. 
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Appellant argues in substance at the bottom of page 10 in the Appeal Brief that the 
Examiner fails to show motivation of record to modify the Graham reference with McKaughan 
because there is no evidence of record to show motivation for Graham to operate in a low power 
to analyze packets. The Examiner respectfully disagrees. The motivation to combine Graham 
with McKaughan as addressed in the final rejection and hereinabove come from McKaughan. 
McKaughan provides the advantage of conserving energy in a computer system while still being 
able to respond to information from the network when necessary (a computer system with the 
ability to dynamically power down conserves energy, col. 3, lines 14-38 and; in one aspect of the 
present invention is to keep the computer in a sleep mode unless an incoming packet to the 
computer matches one of the packets on a list, col. 4, lines 28-51). McKaughan conserves power 
in the computer system by placing the computer system (10, figure 1) in a power down state with 
power only provided to the network interface card (col. 6, lines 60-63). The network interface 
card contains the necessary components to wake up the rest of the computer system (col. 7, lines 
10-28). I 

Appellant also argues in substance at the bottom of page 10 in the Appeal Brief that the 
Examiner has failed to show reasonable expectation of success of the combination of Graham 
and McKaughan because there is no suggestion that the combination would allow analysis of 
packets as required by Graham. The Examiner respectfully disagrees. One of ordinary skill in 
the art would have made necessary changes to allow analysis of packets as taught by Graham. 
Specifically, McKaughan would suggest to one of ordinary skill in the art that components 
required for the analysis of packets would be included in the network interface card of 
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McKaughan because the network interface card of McKaughan would still be powered to allow 
for analysis of packets. 

Appellant also argues in substance at the middle of page 13 that the Examiner combines 
Graham and McKaughan through hindsight because there is no motivation and no reasonable 
expectation of success. The Examiner respectfully disagrees. In response to applicant's argument 
that the examiner's conclusion of obviousness is based upon improper hindsight reasoning, it 
must be recognized that any judgment on obviousness is in a sense necessarily a reconstruction 
based upon hindsight reasoning. But so long as it takes into account only knowledge which was 
within the level of ordinary skill at the time the claimed invention was made, and does not 
include knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. 
See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971). As shown above, 
motivation to combine and a reasonable expectation of success come from the references, 
therefore there is no hindsight reasoning used in the rejections. 

Apellant argues in substance on page 14 that there is no motivation to combine Novoa 
with Graham. The Examiner respectfully disagrees. The motivation to combine Novoa with 
Graham as addressed in the final rejection and hereinabove come from Graham. Graham further 
teaches that his invention is related to dynamically mapping application and port relationships 
(col. 2, lines 20-24) and that dynamic ports are frequently used to provide security (col. 1, lines 
60-63). Graham further teaches that his invention further provides the advantage of improve 
accuracy in the detection and accounting of traffic data, and the ability to accurately report and 
manage such traffic (col. 12, line 66 through col. 13, line 5). Graham further provides the 
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desirable advantage of a dynamically mapping application and port relationships to correctly 
identify applications, protocols and other network data from packet data (col. 2, lines 20-24). 
Therefore, motivation is provided to combine the references. 

Appellant argues in substance on page 1 6 that combining Novoa with Graham would 
result in an addition of a third filter to Novoa. The Examiner does not agree. First, even if the 
combination of Novoa with Graham resulted in a third filter it would still read on the claims. A 
"third filter" would still be interpreted as a second filter since the claims are not limited to only 
two filters and it would provide the function of the second filter and the terms "first", "second", 
and "third" are merely terms with no functionality. Further, it appears that the Appellant is 
arguing that the filter, or functionality of the filter of Graham could not be bodily incorporated in 
to the second filter of Novoa. In response to applicant's argument that filter, or functionality of 
the filter of Graham could not be bodily incorporated in to the second filter of Novoa, the test for 
obviousness is not whether the features of a secondary reference may be bodily incorporated into 
the structure of the primary reference; nor is it that the claimed invention must be expressly 
suggested in any one or all of the references. Rather, the test is what the combined teachings of 
the references would have suggested to those of ordinary skill in the art. See In re Keller, 642 
F.2d 413, 208 USPQ 871 (CCPA 1981). In this case, one of ordinary skill would have 
incorporated the filter, or at least the functionality of the filter of Graham into the second filter of 
Novoa or even as another filter in Novoa because there is motivation, as set forth hereinabove, to 
do make the combination. 
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(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the Related 
Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 



James K. TrujiUo 




Conferees: 



Rehana Perveen 




REHANA PERVEEN 
SUPERVISORY PATENT EXAMINER 





Lynne Browne 



